--storage-opt size=1mb no longer honnored
Open
@ctalledo is already working on this.
Since May 10, 2023.
bug
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
It is no longer possible to limit the root filesize limit of a container with --storage-opt (and an attacker can exhaust the host's inode or size limit - which can result in docker daemon exiting ungracefully).
expected behaviour
# docker run --rm --storage-opt size=1mb alpine dd bs=1M count=2 if=/dev/zero of=/dump.zero
dd: error writing '/dump.zero': No space left on device
1+0 records in
0+0 records out
=> Correct to fail after 1mb
experienced behaviour:
# docker run --rm --runtime=sysbox-runc --storage-opt size=1mb alpine dd bs=1M count=2 if=/dev/zero of=/dump.zero
2+0 records in
2+0 records out
=> This should have failed after 1mb
Checking the underlaying FS shows that prj-id is 0 ('no limit set'):
# docker run --rm --runtime=sysbox-runc --name foobar --storage-opt size=1mb -d alpine sleep 100
# lsattr -dp $(docker inspect foobar --format '{{.GraphDriver.Data.UpperDir }}')
0 --------------e----- /sf/docker/overlay2/ed8815741a4e829f3ef3f730a8f521eb4cd7e9dc859b129ec377d48111d5d8d0/diff
=> The first '0' should be the XFS project ID. I believe 0 means that the storage-limit has not been set.
Running the same without sysbox-runc shows that docker correctly sets the limit:
# docker run --rm --name foobar --storage-opt size=1mb -d alpine sleep 100
lsattr -dp $(docker inspect foobar --format '{{.GraphDriver.Data.UpperDir }}')
63 -------------------- /sf/docker/overlay2/7edf9eef2393201602370ed59e697bccd0962e0a7e2f4299f9079981916e50db/diff
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.